MySaskHealthRecord privacy statement

How is personal health information collected, used and disclosed in connection with MySaskHealthRecord

eHealth Saskatchewan (eHealth) respects that personal health information is private and confidential and takes care to ensure that it is protected and kept in strict confidence. Personal health information is collected, used and disclosed in accordance with The Health Information Protection Act (Saskatchewan) (HIPA).  

The sources of personal health information for MySaskHealthRecord include the following:  

Information you provide yourself

• when you provide your name, address, date of birth, health services number, and e-mail address to create a MySaskHealthRecord account
• when you provide your phone number and e-mail address to subscribe to receive the following types of notifications from MySaskHealthRecord:
  • when new data is available
  • reminders twice a year that you have opted to share your personal health information with another MySaskHealthRecord user
  • when new or updated surgical waitlist scheduling information is available
  • notice of a provincially scheduled appointment, such as your surgical appointment, within 60 and/or 30 days
• when you input your own information into MySaskHealthRecord. This includes:
  • uploading completed health care directives to the Health Care Directives section
  • adding or modifying your name, time zone, phone numbers, email addresses and mailing address in the Contact Information section
  • adding your own reminders and scheduled appointment details
  • adding or modifying any other health details or notes in the predefined fields available in MySaskHealthRecord
• when you connect a third-party device or application to upload your health data
  • MySaskHealthRecord supports connection to the Google Health, Apple Health, Garmin Connect, Withings and Omron Connect. Connecting allows MySaskHealthRecord to seamlessly download and retain your personal health information from the device or application. Personal health information imported into MySaskHealthRecord is subject to eHealth’s data management and retention practices. MySaskHealthRecord supports the deletion of this data via the Connected Devices management page. If you choose to delete your MySaskHealthRecord account, all connected device data is subject to deletion.  

Information eHealth collects from provincial systems

• • To verify and complete the information you provide when creating your account. This information comes from the system used to register Saskatchewan residents for provincial health benefits (the Person Health Registration System).
  • To provide you with access to your surgical waitlist information from the Saskatchewan Surgical Care Network.
  • To provide you with access to your personal health information from the Provincial Electronic Health Record which contains following sources:
    • laboratory results – lab results stored in eHealth’s Saskatchewan Laboratory Results Repository
    • clinical documents – clinical documents, such as consultations and discharge summaries, that are stored in eHealth’s Clinical Documents Repository
    • clinical visit history – a list of visits to participating facilities that are stored in eHealth’s Clinical Encounters Repository
    • medical imaging reports – reports from the Radiology Information System
    • immunizations – events recorded in Panorama, Saskatchewan’s immunization registry
    • prescription fill history – medications records in the provincial Pharmaceutical Information Program
    • surgical waitlist details – appointment information stored in the Saskatchewan Surgical Care Network 

The information collected as described above is only used to:

• confirm your identity
• support and provide the MySaskHealthRecord service
• contact you to conduct occasional surveys and other customer research
• Health care directives that you input into MySaskHealthRecord may be shared with the provincial Electronic Health Record (eHR) Viewer at your discretion.

eHealth has implemented a feature that will allow you to upload your health care directive to MySaskHealthRecord and share it with health care providers via the eHR Viewer. The eHR Viewer is a secure website authorized health care providers can use to access patient information, no matter where a patient presents for care. 

Customer surveys and other customer research are done to better understand the customer impact and user feeling of MySaskHealthRecord Service, and to help improve the MySaskHealthRecord user experience. Please note: These surveys are entirely voluntary and you may decline to participate at any time by contacting  MySaskHealthRecord

eHealth does not use or disclose your personal health information to any person or organization or for any other purposes unless it has your consent or is otherwise authorized by law. 

Does MySaskHealthRecord collect, use or disclose any other information? 

MySaskHealthRecord uses Google Analytics to collect anonymous technical information. For example, this information may include active user and session statistics, approximate geolocation, and browser and device information. This anonymous technical information may be used by eHealth for purposes such as statistical analysis and reporting. eHealth reserves the right to disclose such information to third parties. If you wish, you may opt out of Google Analytics by installing the Google Analytics Opt-Out add-on for your web browser. Alternatively, you may configure your web browser settings to block the use of cookies. 

What information in MySaskHealthRecord is shared with the eHR Viewer and who can access it?

The eHR Viewer is a secure website authorized health care providers can use to access patient information, no matter where a patient presents for care. When you upload a health care directive into the Health Care Directive widget, limited data such as the date a document was uploaded and status of not shared will be visible in the eHR Viewer. If you opt into sharing your health care directive, the document will also be shared and available on your eHR Viewer profile.  

Only members of the health care team involved in your care may view your information in the eHR Viewer. This may include physicians, pharmacists, nurse practitioners and designated staff. All of these health care team members will have completed an approval process by eHealth and are aware of the importance of the privacy of personal health information. More information about the privacy of your information in the eHR Viewer is available on our website or by contacting the eHealth Privacy Service.

What if I change my mind about sharing my health care directive or need to update it?

You may opt out at any time by updating the settings in your MySaskHealthRecord account. You may also upload new or edited health care directives and/or delete any that you no longer wish to be displayed. You may request assistance by contacting MySaskHealthRecord. 

eHealth recommends keeping clear communication with your health care provider regarding any changes to your health care directive to ensure they are aware that an updated version has been added to the eHR Viewer. If your health care provider(s) does not have access to the eHR Viewer, you will need to communicate with them to ensure they have access to your health care directive. 

Who is accountable for the personal health information in the MySaskHealthRecord?

eHealth is accountable. Specifically, eHealth's Chief Privacy Officer is responsible for overseeing eHealth's privacy compliance program and to receive and address privacy related complaints and concerns associated with MySaskHealthRecord. If you have a privacy-related complaint or concern regarding MySaskHealthRecord or eHealth’s privacy policies and practices, we encourage you to contact the eHealth Privacy Service.

If eHealth is unable to resolve your privacy-related complaint or concern to your satisfaction, you may contact the Saskatchewan Office of the Information and Privacy Commissioner for additional assistance and information. This provincial office oversees HIPA in Saskatchewan. The contact information for the Saskatchewan Office of the Information and Privacy Commissioner is as follows:  

Office of the Saskatchewan Information and Privacy Commissioner

503 - 1801 Hamilton Street  
Regina, SK S4P 4B4  
Phone: (306) 787-8350  
Toll-Free Phone (within Saskatchewan): 1-877-748-2298
Email: intake@oipc.sk.ca

What safeguards are in place to protect my personal health information?

Privacy safeguards outlined in HIPA apply to the personal health information in MySaskHealthRecord. Personal health information in MySaskHealthRecord is kept in strict confidence and is used or disclosed only as authorized or required by law. 

In addition, eHealth has strict security safeguards in place, including policies, practices, and computer systems that are designed to protect information from unauthorized use, error, or loss. For more information on how eHealth protects personal health information, please visit eHealth’s website Privacy pages or contact the eHealth Privacy Service. 

What if I notice an error in my personal health information? 

MySaskHealthRecord enables you to correct the personal health information you have inputted yourself and allows you to make comments on your personal health information from the Provincial Electronic Health Record in your MySaskHealthRecord. Please note these comments are only viewable in MySaskHealthRecord and will not be viewable in the Provincial Electronic Health Record. If you see information provided by eHealth that you would like to request changes or amendment to, please contact MySaskHealthRecord.

How long is my personal health information retained in MySaskHealthRecord? 

Information you enter into your MySaskHealthRecord account, as well as information you upload from a third party device is stored as long as you have your account. You have the option to delete the information at any time and any information you have entered will be deleted if you delete your account. 

Information collected from provincial systems, such as the Provincial Electronic Health Record, is subject to the retention policies of those systems. However, any provincially-sourced personal health information will be deleted if you delete your account.

What if I want access to my personal health information and it is not in MySaskHealthRecord?

Requests for personal health information must be made to its trustee. A trustee is the person or organization who has custody or control of your personal health information. If you are not sure who the trustee of your personal health information is, you can contact the eHealth Privacy Service for assistance. 

If you have any questions regarding accessing your personal health information, please contact the eHealth Privacy Service.

What is eHealth's relationship with TELUS with respect to MySaskHealthRecord?

eHealth has engaged TELUS Health Solutions Inc. (TELUS) to provide information technology and information management services for MySaskHealthRecord through the TELUS health space® platform. The contract between TELUS and eHealth clearly states that eHealth controls and is accountable for the personal health information stored in MySaskHealthRecord. Further, the contract includes reasonable and appropriate provisions to protect the security and confidentiality of the personal health information and to ensure the information is stored in Canada and is subject to Canadian privacy laws.